chore(deps): bump azure/setup-helm from 4 to 5

.env.example

@@ -30,13 +30,18 @@ UI_URL=https://dashboard.example.com/
 # login that hasn't signed in yet still consumes a seat the moment it
 # does — past the cap, new sign-ins are rejected at the OAuth
 # callback. An admin can free seats at /admin.
-ALLOWED_GITHUB_USERS=sppidy
+ALLOWED_GITHUB_USERS=
 
 # Optional: pin a specific GitHub login as the bootstrap admin. Useful
 # when the allowlist contains multiple users and you need a particular
 # one to land in the admin role on first contact.
 # BOOTSTRAP_ADMIN=sppidy
 
+# Exact CIDR(s) of the reverse proxy peer as seen by the server container.
+# Forwarded client-IP headers are ignored from every other peer. Do not use
+# 0.0.0.0/0; inspect the Docker/ingress network and list only its gateway CIDR.
+TRUSTED_PROXY_CIDRS=
+
 # Public WebSocket URL the Next.js client connects to.
 NEXT_PUBLIC_WS_URL=wss://dashboard.example.com/ui/ws
 

.github/workflows/agent-k8s-image.yml

@@ -4,11 +4,15 @@ on:
   push:
     branches: [main]
     paths:
+      - "Cargo.toml"
+      - "Cargo.lock"
       - "agent/**"
+      - "server/**"
       - "shared/**"
       - "Dockerfile.agent.k8s"
       - "helm/**"
       - "agent"
+      - "server"
       - "shared"
       - ".github/workflows/agent-k8s-image.yml"
   workflow_dispatch:
@@ -60,7 +64,7 @@ jobs:
               url."https://x-access-token:${SUBMODULES_PAT}@github.com/".insteadOf \
               "https://github.com/"
           fi
-          git submodule update --init --recursive --depth 1 agent shared
+          git submodule update --init --recursive --depth 1 agent server shared
 
       - name: Set up Buildx
         uses: docker/setup-buildx-action@v4

.github/workflows/ci.yml

@@ -20,7 +20,6 @@ jobs:
       - uses: actions/checkout@v6
         with:
           submodules: recursive
-          token: ${{ secrets.SUBMODULES_PAT }}
       - uses: dtolnay/rust-toolchain@stable
         with:
           components: clippy
@@ -44,7 +43,6 @@ jobs:
       - uses: actions/checkout@v6
         with:
           submodules: recursive
-          token: ${{ secrets.SUBMODULES_PAT }}
       - uses: actions/setup-node@v4
         with:
           node-version: 22
@@ -60,7 +58,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
-      - uses: azure/setup-helm@v4
+      - uses: azure/setup-helm@v5
       - name: Lint chart
         run: helm lint helm/shellfleet-agent
       - name: Template smoke test (defaults render)